The upcasted AWS S3 for WordPress Plugin – Upcasted (versions up to 3.0.3) contains a stored cross-site scripting (XSS) vulnerability due to improper input neutralization during web page generation. This vulnerability allows an attacker with low privileges and requiring user interaction to execute scripts in a context that can affect confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The affected product is a cloud service, and the vendor is responsible for applying the patch and managing remediation.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The impact affects confidentiality, integrity, and availability but is limited by the requirement for user interaction and low privilege level.

A patch is available for this vulnerability, and since the product is a cloud service, the vendor manages remediation server-side. Users should verify with the vendor advisory that the patch has been applied. No additional action is required if the vendor confirms mitigation. If using a self-hosted or on-premises version, update to the fixed version beyond 3.0.3 as soon as possible.